fix: restore top-level security, health probe overrides, and additionalProperties after swag regen

swag init does not emit global security or per-operation security overrides,
so these must be re-patched after every regeneration run. Restores:
- Top-level `security: [{ApiKeyAuth: []}, {OIDCAuth: []}]` in both swagger files
- `security: []` on /healthz and /readyz so probes remain unauthenticated once the
  global default is active
- `additionalProperties: true` on WorkflowDetailResponse.definition (free-form JSON object)

Addresses CodeRabbit feedback on PR #129.

https://claude.ai/code/session_01LZPDwwXPmh3NoRfpJ7qNrc

Author: claude

packages/engine/internal/server/docs/swagger.json

@@ -1,7 +1,7 @@
 {
     "swagger": "2.0",
     "info": {
-        "description": "Headless AI workflow automation — BYOK, IaC-first, enterprise-grade.",
+        "description": "Headless AI workflow automation \u2014 BYOK, IaC-first, enterprise-grade.",
         "title": "Mantle API",
         "contact": {
             "name": "Mantle",
@@ -632,7 +632,8 @@
                             "$ref": "#/definitions/server.HealthResponse"
                         }
                     }
-                }
+                },
+                "security": []
             }
         },
         "/readyz": {
@@ -657,7 +658,8 @@
                             "$ref": "#/definitions/server.ReadyzResponse"
                         }
                     }
-                }
+                },
+                "security": []
             }
         }
     },
@@ -932,7 +934,8 @@
             "properties": {
                 "definition": {
                     "description": "Free-form workflow definition as stored (YAML parsed to JSON).",
-                    "type": "object"
+                    "type": "object",
+                    "additionalProperties": true
                 },
                 "name": {
                     "type": "string"
@@ -1025,10 +1028,18 @@
             "in": "header"
         },
         "OIDCAuth": {
-            "description": "Bearer OIDC JWT. Format: \"Bearer \u003cjwt\u003e\"",
+            "description": "Bearer OIDC JWT. Format: \"Bearer <jwt>\"",
             "type": "apiKey",
             "name": "Authorization",
             "in": "header"
         }
-    }
-}
+    },
+    "security": [
+        {
+            "ApiKeyAuth": []
+        },
+        {
+            "OIDCAuth": []
+        }
+    ]
+}

packages/engine/internal/server/docs/swagger.yaml

@@ -180,6 +180,7 @@ definitions:
   server.WorkflowDetailResponse:
     properties:
       definition:
+        additionalProperties: true
         description: Free-form workflow definition as stored (YAML parsed to JSON).
         type: object
       name:
@@ -641,6 +642,7 @@ paths:
           description: OK
           schema:
             $ref: '#/definitions/server.HealthResponse'
+      security: []
       summary: Liveness probe
       tags:
       - system
@@ -657,9 +659,13 @@ paths:
           description: Service Unavailable
           schema:
             $ref: '#/definitions/server.ReadyzResponse'
+      security: []
       summary: Readiness probe
       tags:
       - system
+security:
+- ApiKeyAuth: []
+- OIDCAuth: []
 securityDefinitions:
   ApiKeyAuth:
     description: 'Bearer API key. Format: "Bearer mk_..."'